Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5053594

KB5053594: Cumulative update for Windows 10, version 1607, March 2025. Exploited kernel, NTFS and FAT flaws patched

In short

Fixes 30 security vulnerabilities, including six actively exploited flaws, and makes system temporary files safer. It also fixes a process-creation race condition and updates Paraguay’s daylight saving time.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607.

Build
14393.7876
Security
30 fixed · 2 critical · 6 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In detail Windows 10 Enterprise LTSB 2016 (version 1607) has an end-of-updates date of October 13, 2026. The October 14, 2025 date is the general Windows 10 support date.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 2 changes

Security

For: Windows 10 Enterprise LTSB 2016 devices

  • The update addresses security issues in Windows.1

Use-after-free (UAF) risk

For: Windows 10 Enterprise LTSB 2016 devices

  • A race condition during process creation no longer creates a use-after-free risk.2

Improvements 2 changes

Temporary files

For: Windows 10 Enterprise LTSB 2016 devices

  • System processes can store temporary files in a secure directory, reducing the risk of unauthorized access.3
    Uses C:\Windows\SystemTemp through the GetTempPath2 API or .NET's GetTempPath API.

Daylight saving time (DST)

For: Devices using Paraguay's time zone

  • Daylight saving time changes for Paraguay are updated.4

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5055521
VersionBuildChannel
1607 14393.7876 General availability

Security

30 vulnerabilities fixed
6 exploited 2 critical 28 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24983 Exploited
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24051
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-24056
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-21180
Windows exFAT File System Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24044
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24046
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24048
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24050
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24059
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24061
Windows Mark of the Web Security Feature Bypass Vulnerability
 Important 7.8
CVE-2025-24066
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24067
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24072
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24995
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24987
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24988
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24071
Microsoft Windows File Explorer Spoofing Vulnerability
 Important 6.5
CVE-2025-24996
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24992
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-21247
MapUrlToZone Security Feature Bypass Vulnerability
 Important 4.3
CVE-2025-24055
Windows USB Video Class System Driver Information Disclosure Vulnerability
 Important 4.3
CVE-2024-9157
Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability
 Important —

Updated components

930 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio17
Graphics and display12
Kernel8
Search8
File Explorer and shell7
Hyper-V and virtualization5
Security and sign-in4
Settings4
Storage and file systems4
Secure Boot3
Networking2
Remote Desktop2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This update addresses security issues for your Windows operating system. support.microsoft.com
  2. 2. Fixed: A race condition might lead to a UAF risk during process creation. support.microsoft.com
  3. 3. This update enables system processes to store temporary files in a secure directory "C:\Windows\SystemTemp" via either calling GetTempPath2 API or using .NET's GetTempPath API, thereby reducing the risk of unauthorized access. support.microsoft.com
  4. 4. Updated: DST changes for Paraguay. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 5/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake